---
id: change/bcapps/11734
type: change
title: "#11734 [VIES Integration] Per-environment daily request rate-limit"
summary: A per-tenant daily rate-limit of 2000 VIES lookups prevents a single tenant from flooding the shared outbound IP used by Business Central online, which could deny-list the IP for all co-located tenants.
tier: official
language: en
tags:
  - feature
  - main
  - bc30
  - codeunit vat lookup ext. data hndl
  - codeunit vat lookup quota mgt.
  - table vat reg. no. lookup quota
system: finance
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:03:56.926Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: e854bf074e5014012fa99f5c1c6305813beb7595
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/11734
    title: "microsoft/BCApps#11734: [VIES Integration] Per-environment daily request rate-limit"
    date: "2026-09-24"
    commit: e854bf074e5014012fa99f5c1c6305813beb7595
    t: null
    quote: null
links:
  learn: []
  objects:
    - object/codeunit/248
    - object/codeunit/247
    - object/table/243
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 11734
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/11734
kind: pr
base_branch: main
major: "30"
merged_at: "2026-09-24T07:29:00Z"
author: dcenic
author_type: User
community_contribution: false
labels:
  - "Team: Finance"
change_class: code
change_kind: feature
behavior_change: true
breaking: false
files:
  count: 4
  additions: 306
  deletions: 0
  al: 3
apps:
  - Base Application
objects_touched:
  - key: codeunit/248
    page: codeunit/248
    type: codeunit
    id: 248
    name: VAT Lookup Ext. Data Hndl
    app: Base Application
    status: modified
  - key: codeunit/247
    page: codeunit/247
    type: codeunit
    id: 247
    name: VAT Lookup Quota Mgt.
    app: Base Application
    status: added
  - key: table/243
    page: table/243
    type: table
    id: 243
    name: VAT Reg. No. Lookup Quota
    app: Base Application
    status: added
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 651007
systems:
  - finance
quote: null
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #11734 [VIES Integration] Per-environment daily request rate-limit

> A per-tenant daily rate-limit of 2000 VIES lookups prevents a single tenant from flooding the shared outbound IP used by Business Central online, which could deny-list the IP for all co-located tenants.

[Pull request](https://github.com/microsoft/BCApps/pull/11734) · merged into `main` (BC30) on 2026-09-24 by dcenic · 4 files (+306 -0), 3 AL · feature · tier official · reviewed (checked by Opus)

## What changed

- New table 243 'VAT Reg. No. Lookup Quota' and codeunit 247 'VAT Lookup Quota Mgt.' enforce a daily limit in codeunit 248 before the SOAP call to VIES
- The counter resets when the UTC day changes and is shared by all callers, including extensions, job queue and API callers
- The 2000 lookups per day cap is about 10x the 99th-percentile legitimate usage and about 10x below the volume that triggers VIES deny-listing
- Applies only to Business Central online; on-premises behavior is unchanged
- Once the cap is reached lookups fail with an error for the rest of the UTC day; the call hitting the limit logs a security-audit entry and telemetry
- Behaviour changes for users or extensions.

## AL objects touched

- [Codeunit 248 "VAT Lookup Ext. Data Hndl"](../../objects/codeunit/248.md), Base Application: modified
- [Codeunit 247 "VAT Lookup Quota Mgt."](../../objects/codeunit/247.md), Base Application: added
- [Table 243 "VAT Reg. No. Lookup Quota"](../../objects/table/243.md), Base Application: added

## Context

- Work items: AB#651007
- Labels: Team: Finance
- Systems: finance

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).